\documentclass[landscape]{seminar}
\slideframe{none}
\usepackage{epsf}
\usepackage{color}
\usepackage{amssymb,amsfonts}
\newcommand{\ket}[1]{\left| \, #1 \right\rangle}
\newcommand{\bra}[1]{ \left\langle #1 \, \right|}
\newcommand{\braket}[2]{ \left\langle #1 | #2 \right\rangle}
\newcommand{\proj}[1]{\ket{#1}\bra{#1}}
\newcommand{\vpols}{\mbox{$\updownarrow$}}
\newcommand{\hpols}{\mbox{$\leftrightarrow$}}
\newcommand{\ppols}{\mbox{\small
\,\mbox{$\nearrow$}\llap{\mbox{$\swarrow$}}\,}}
\newcommand{\qpols}{\mbox{\small
\,\mbox{$\searrow$}\llap{\mbox{$\nwarrow$}}\,}}
\newcommand{\rpols}{\mbox{\raisebox{-0.66ex}{$\triangleleft$}$\!\!\supset$}}
\newcommand{\lpols}{\mbox{$\subset\!\!$\raisebox{-0.66ex}{$\triangleright$}}}
\newcommand{\rz}{{\color{red}0}}
\newcommand{\ro}{{\color{red}1}}
\newcommand{\bz}{{\color{blue}0}}
\newcommand{\bo}{{\color{blue}1}}
\begin{document}
\begin{slide}
\begin{center}
{\large
Quantum Error Correcting Codes and Quantum Cryptography
}
Peter Shor\\
M.I.T.\\
Cambridge, MA 02139
\end{center}
\end{slide}
\begin{slide}
We start out with two processes which are fundamentally quantum: superdense
coding and teleportation.
Superdense coding begins with the question: How much information can one
qubit convey? Holevo's bound (we discuss this later) says that one qubit
can only convey one bit. However, if a sender and receiver share
entanglement, i.e., one EPR pair, they can use this entanglement and one
qubit to send two classical bits.
\end{slide}
\begin{slide}
The four states (the Bell basis) are mutually orthogonal
\[
{\textstyle{\frac{1}{\sqrt{2}}}}(\ket{00} + \ket{11}) \quad
{\textstyle{\frac{1}{\sqrt{2}}}}(\ket{00} - \ket{11}) \quad
{\textstyle{\frac{1}{\sqrt{2}}}}(\ket{01} + \ket{10}) \quad
{\textstyle{\frac{1}{\sqrt{2}}}}(\ket{01} - \ket{10})
\]
Any one can be turned into any other (up to a phase factor)
by applying the appropriate Pauli matrix to either of the two
qubits.
\begin{eqnarray*}
\mbox{id} = \left(\begin{array}{cc}1 & 0\\0 & 1\end{array}\right) &\qquad&
\sigma_x = \left(\begin{array}{cc}0 & 1\\1 & 0\end{array}\right) \\
\sigma_y = \left(\begin{array}{cc}0 & -i\\i & 0\end{array}\right) &\qquad&
\sigma_z = \left(\begin{array}{cc}1 & 0\\0 & -1\end{array}\right)
\end{eqnarray*}
\end{slide}
\begin{slide}
{\large{Superdense Coding:}}
\epsfxsize=2.8in
\vspace*{\fill}
\epsfbox{superdense-color.eps}
\vspace*{\fill}
\end{slide}
\begin{slide}
{\large Superdense Coding}\\
Alice and Bob start with the
state $\frac{1}{\sqrt{2}}(\ket{00}_{AB} + \ket{11}_{AB})$, where
Alice holds the first qubit and Bob the second.
Alice applies one of the four Pauli matrices to her qubit, and sends her
qubit to Bob. He can then tell all four Bell states apart, so he knows
which Pauli matrix Alice applied. This sends four possibilities (two
classical bits) using one qubit and one EPR pair (ebit).
\end{slide}
\begin{slide}
{\large{Teleportation:}}\\
This is a converse proces to superdense coding.
\epsfxsize=2.8in
\vspace*{\fill}
\epsfbox{teleport-color.eps}
\vspace*{\fill}
\end{slide}
\begin{slide}
{\large{Teleportation:}}
{\color{red} Alice}
and
{\color{blue} Bob}
share an EPR pair in the state
$\frac{1}{\sqrt{2}}(\ket{\rz \bz} + \ket{\ro \bo})$.
{\color{red} Alice} has a qubit in the unknown state
$\alpha \ket{\rz} + \beta \ket{\ro}$.
The joint state is
{\large
\[
\frac{1}{\sqrt{2}}
(\alpha \ket{\rz} + \beta \ket{\ro})
(\ket{\rz \bz} + \ket{\ro \bo})
\]
}
This can be rewritten (using distributive law, etc.) as
{\large
\begin{eqnarray*}
\frac{1}{\sqrt{8}}\Big[\phantom{+}
(\ket{\rz \rz} + \ket{\ro \ro})&\hspace{-.5em}&(\alpha\ket{\bz} + \beta\ket{\bo})\\
+(\ket{\rz \rz} - \ket{\ro \ro})&\hspace{-.5em}&(\alpha\ket{\bz} - \beta\ket{\bo})\\
+(\ket{\ro \rz} + \ket{\rz\ro})&\hspace{-.5em}&(\beta\ket{\bz} + \alpha\ket{\bo})\\
+(\ket{\ro \rz} - \ket{\rz\ro})&\hspace{-.5em}&(\beta\ket{\bz} - \alpha\ket{\bo})
\Big]
\end{eqnarray*}
}
\end{slide}
\begin{slide}
{\large{Teleportation:}}
Recall the joint state was
{\large
\begin{eqnarray*}
\frac{1}{\sqrt{8}}\Big[\phantom{+}
(\ket{\rz \rz} + \ket{\ro \ro})&\hspace{-.5em}&(\alpha\ket{\bz} + \beta\ket{\bo})\\
+(\ket{\rz \rz} - \ket{\ro \ro})&\hspace{-.5em}&(\alpha\ket{\bz} - \beta\ket{\bo})\\
+(\ket{\ro \rz} + \ket{\rz\ro})&\hspace{-.5em}&(\beta\ket{\bz} + \alpha\ket{\bo})\\
+(\ket{\ro \rz} - \ket{\rz\ro})&\hspace{-.5em}&(\beta\ket{\bz} - \alpha\ket{\bo})
\Big]
\end{eqnarray*}
}
{\color{red} Alice}'s four states on the above four lines are all orthogonal.
This means {\color{red} Alice} can measure which of the four Bell states
she has. By the rules of quantum measurement,
{\color{blue}Bob} then has his corresponding
state. {\color{red}Alice} sends
her results to {\color{blue} Bob}, who can then transform his state into
$\alpha\ket{\bz} + \beta\ket{\bo}$ using a unitary operator.
\end{slide}
\begin{slide}
Let's generalize to higher dimensional quantum states, and to more
arbitrary generalizations of the Pauli matrices. Suppose Alice and
Bob share the state
\[\ket{\psi} = \frac{1}{\sqrt{d}}\sum_{i=1}^d \ket{i}_A \ket{i}_B\]
and suppose they have a set of $d^2$ unitary transformations $U_x$
generalizing the Pauli matrices.
What it means in this case
to generalize the Pauli matrices is that all $d^2$ states
\[ (U_x \otimes I )\ket{\psi} \]
form an orthonormal basis. This is clearly what you need for superdense
coding. It suffices for teleportation as well.
\end{slide}
\begin{slide}
Lemma:
\[
(U\otimes I) \ket{\psi} = (I \otimes U^\dag) \ket{\psi}
\]
Proof: (dropping the normalization $1/\sqrt{d}$)
\begin{eqnarray*}
{}_A\!\bra{j}_B\!\bra{k} U\otimes I \left(\sum_i\ket{i}_A\ket{i}_B\right) &=&
\sum_i \bra{j} U \ket{i} \braket{k}{i} \\
&=& \bra{j}U\ket{k} = \bra{k}U^\dag\ket{j} \\
&=&\sum_i \braket{j}{i} \sum_i \bra{k} U^\dag \ket{i} \\
&=&
{}_A\!\bra{j}_B\!\bra{k} I\otimes U^\dag \left(\sum_i\ket{i}_A\ket{i}_B\right)
\end{eqnarray*}
\end{slide}
\begin{slide}
Now, Alice starts with
$ \ket{\phi}_A \ket{\psi}_{AB}$. She measures this state in the basis
${}_{AA}\!\bra{\psi} (I \otimes U_x^\dag)$ . Thus, she will observe one of
these states. What state does Bob now have?
\[
{}_{AA}\!\bra{\psi} (I \otimes U_x^\dag\otimes I) \ket{\phi}_{A}
\ket{\psi}_{AB} =
{}_{AA}\!\bra{\psi} (I \otimes I \otimes U_x) \ket{\phi}_{A}
\ket{\psi}_{AB} \]
Now, Alice can send the measured $x$ to Bob, who can then apply
$U_x^\dag$ to his state, obtaining
\begin{eqnarray*}
({}_{AA}\!\bra{\psi} ) \ket{\phi}_{A} \ket{\psi}_{AB} &=&
\frac{1}{d} {\sum_j}{}_A\!\bra{j}{}_A\!\bra{j} \sum_i \phi_i\ket{i}_A
\sum_k \ket{k}_A\ket{k}_B\\ &=& \frac{1}{d} \sum_k \phi_k \ket{k}_B,
\end{eqnarray*}
as desired. The $\frac{1}{d}$ reflects the probability of ${1}/{d^2}$ of obtaining
each $U_x$.
\end{slide}
\begin{slide}
{\large Teleporting through a gate}\\
Suppose that we have a quantum gate G such that $G U_x = U_{x'} G$ for some
$x'$, for all of the $U_x$ above. Then, if Alice and Bob start with
the state
\[
G \psi = \frac{1}{\sqrt{d}} G \sum_{i=1}^d \ket{i}_A \ket{i}_B,
\]
and Alice also has the state $\ket{\phi}$.
then Alice and Bob can apply the teleportation procedure, and Bob can
correct his state using $U_{x'}$ instead of $U_x$. This gives Bob
the state $G\ket{\phi}$.
\end{slide}
\begin{slide}
This can be useful in certain situations.
For instance, if the $U_i$ are the Pauli matrices, and G is the
controlled not gate,
\[
\mbox{CNOT} = \left(\begin{array}{cccc}
1&0&0&0\\
0&1&0&0\\
0&0&0&1\\
0&0&1&0
\end{array}
\right)
\]
Then Alice and Bob can do the two-qubit CNOT gate using joint Bell
state measurements and the one-qubit Pauli gates.
\end{slide}
\begin{slide}
One of the nicest sets of generalizations of the Pauli matrices in
$d$-dimensions is obtained by using $R^aT^b$, where $0 \leq a,b \leq d-1$.
{\tiny
\[
R = \left(\begin{array}{ccccc}
1 & 0 & 0 & \ldots & 0\\
0 & e^{2i\pi/d} & 0 & \ldots & 0\\
0 & 0 & e^{4i\pi /d} & \ldots & 0\\
\vdots & \vdots & \vdots & & \vdots\\
0 & 0 & 0 & \ldots & e^{2(d-1)i\pi /d}
\end{array} \right)
\qquad
T = \left( \begin{array}{ccccc}
0 & 1 & 0 & 0 & \ldots \\
0 & 0 & 1 & 0 & \ldots \\
0 & 0 & 0 & 1 & \ldots \\
\vdots & \vdots & \vdots & \vdots & \\
1 & 0 & 0 & 0 & \ldots
\end{array}\right)
\]
}
These have nice communtation relations, so $TR = e^{2 \pi i/d}RT$.
\end{slide}
\begin{slide}
When the quantum prime factorization algorithm was announced in 1994,
one reaction was that this would never work because errors would
inevitably disrupt the computation.
How bad is the situation? \\
To do $10^9$ steps on a quantum computer, you need to do each
step with inaccuracy less than $10^{-9}$. This seems virtually
impossible to experimental physicists.
\end{slide}
\begin{slide}
The same objection was raised to scaling up classical computers
in the 1950's.
Von Neumann showed that you could build reliable classical computers
out of unreliable classical components.
Currently, we don't use many of these techniques because we have
{\em extremely} reliable chips, so we don't need them.
\end{slide}
\begin{slide}
{\large Classical fault-tolerance techniques.}
1) Consistency checks\\*[.2in]
2) Checkpointing\\*[.2in]
3) Error-correcting codes\\*[.2in]
4) Massive redundancy
\end{slide}
\begin{slide}
{\large No-cloning theorem:}
You cannot duplicate an unknown quantum state.
\medskip
{\large Heisenberg uncertainty principle:}
You cannot completely measure a quantum state.
\end{slide}
\begin{slide}
{\large Classical fault-tolerance techniques.}
1) Consistency checks\\
\hspace*{4em} Doesn't get you very far (quantum or classical)\\
2) Checkpointing\\
\hspace*{4em}Doesn't work in quantum case\\
3) Error-correcting codes\\
\hspace*{4em}These work!\\
4) Massive redundancy\\
\hspace*{4em}Doesn't seem to get you very far in quantum case.
\end{slide}
\begin{slide}
Best current results
If the quantum gates are accurate to reduce noise to 1 part in $30$,
you can make fault-tolerant quantum circuits (Knill).
This requires a ridiculous amount of overhead. Noise of 1 part
in $1000$ might lead to more reasonable overheads.
(These estimates may use some heuristic arguments; the best rigorous
result I know of is 1 part in $10^6$.)
The best upper bound is around 1 part in 5.
Open question: what is the right threshold?
\end{slide}
\begin{slide}
Outline:
\begin{itemize}
\item Quantum error correcting codes \\
\hspace*{.1in} -- a simple example\\
\hspace*{.1in} -- CSS codes \\
\hspace*{.1in} -- quantum cryptography
\end{itemize}
\end{slide}
\begin{slide}
\[
\parbox{2.4in}{The simplest classical error correcting code is the repetition
code.}\qquad\hspace{\fill}
\begin{array}{ccc}
0 & \rightarrow & 000 \\
1 & \rightarrow & 111
\end{array}\hspace*{2ex}
\]
\[
\parbox{2.4in}{
What about the quantum version?
}\qquad\hspace{\fill}
\begin{array}{ccc}
\ket{0} & \rightarrow & {\ket{000}} \\
\ket{1} & \rightarrow & \ket{111}
\end{array}
\]
This works against bit flips
\[
\sigma_x =
\left(
\begin{array}{cc}
0&1\\
1&0
\end{array}
\right)
\]
\[
\sigma_x(2):
\begin{array}{ccc}
\ket{000} & \rightarrow & \ket{010}\\
\ket{111} & \rightarrow & \ket{101}
\end{array}
\]
Can measure ``which bit is different?''\\
Possible answers: none, bit 1, bit 2, bit 3.\\
Applying $\sigma_x$ to incorrect bit corrects error.
\end{slide}
\begin{slide}
This works for superpositions of encoded $\ket{0}$ and $\ket{1}$.
\[
\sigma_x(2): \alpha\ket{000} + \beta \ket{111} \rightarrow
\alpha\ket{010} + \beta \ket{101} \]
When this is measured, the result is ``bit 2 is flipped,'' and since
the measurement gives the same answer for both elements of the superposition,
the superposition is not destroyed.
Thus, bit 2 can now be corrected by applying $\sigma_x(2)$.
\end{slide}
\begin{slide}
Three-bit code
\begin{eqnarray*}
\ket{0} & \rightarrow & \ket{000} \\
\ket{1} & \rightarrow & \ket{111}
\end{eqnarray*}
What about a phase flip error
\[
\sigma_z =
\left(
\begin{array}{cc}
1&\phantom{-}0\\
0&-1
\end{array}
\right) \ ?
\]
\begin{eqnarray*}
\ket{E_0} = \ket{000} & \rightarrow & \phantom{-}\ket{000} = \ket{E_0}\\
\ket{E_1} = \ket{111} & \rightarrow & - \ket{111} = \ket{E_1}
\end{eqnarray*}
A phase flip on any qubit gives a phase flip on the encoded qubit, so
phase flips are three times as likely.
\end{slide}
\begin{slide}
{\large Our story so far.}
The three-bit code corrects bit flips, but makes phase flips
three times as more likely
The same thing happens for a general phase error
\[
\left(
\begin{array}{cc}
1&\phantom{,}0\\
0&e^{i \theta}
\end{array}
\right) .
\]
\end{slide}
\begin{slide}
{\large Another 3-qubit code}
The unitary transformation
$
H =
\frac{1}{\sqrt{2}}
\left(
\begin{array}{cc}
1&\phantom{-}1\\
1&-1
\end{array}
\right)
$
takes phase flips to bit flips and vice versa:
\[
H
\left(
\begin{array}{cc}
0&\phantom{-}1\\
1&\phantom{-}0
\end{array}
\right)
H =
\left(
\begin{array}{cc}
1&\phantom{-}0\\
0&-1
\end{array}
\right)
\]
Suppose we apply H to the 3 encoding qubits and the encoded qubit. What
does this do to our code?
Get new code
\begin{eqnarray*}
\ket{0} &\rightarrow & \frac{1}{2}\left( \ket{000} + \ket{011} + \ket{101}
+ \ket{110} \right) \\
\ket{1} &\rightarrow & \frac{1}{2}\left( \ket{100} + \ket{010} + \ket{001}
+ \ket{111} \right)
\end{eqnarray*}
\end{slide}
\begin{slide}
\begin{eqnarray*}
\ket{0} &\rightarrow & \frac{1}{2}\left( \ket{000} + \ket{011} + \ket{101}
+ \ket{110} \right) \\
\ket{1} &\rightarrow & \frac{1}{2}\left( \ket{100} + \ket{010} + \ket{001}
+ \ket{111} \right)
\end{eqnarray*}
Encoded $\ket{0}$: superposition of states with an even number of 1's.\\
Encoded $\ket{1}$: superposition of states with an odd number of 1's.
A bit flip on any qubit exchanges 0 and 1.
A phase flip on any qubit is correctable. E.g.,
$ \left(
\begin{array}{cc}
1&\phantom{-}0\\
0&-1
\end{array}
\right)
$ on bit 3.
\[
\sigma_z(3) \ket{E_0} =
\frac{1}{2}\left( \ket{000} - \ket{011} - \ket{101} + \ket{110} \right)
\]
This is orthogonal to $\sigma_z(a) \ket{E_b}$ unless $a=3$, $b=0$.
So we can measure ``which qubit has a phase flip?'' and then correct this
qubit.
\end{slide}
\begin{slide}
{\large The 9-qubit code}
First quantum error correcting code discovered:
\[
\ket{0} \rightarrow \frac{1}{2}
(\ket{000000000}+\ket{000111111} +\ket{111000111} + \ket{111111000})
\]
\[
\ket{1} \rightarrow
\frac{1}{2}(\ket{111000000} +\ket{000111000} +\ket{000000111}+\ket{111111111})
\]
This code will correct any error in one of the nine qubits.
Two concatenated codes: the outer one corrects phase errors, and the inner
one corrects bit errors.
If you have a bit flip:
{\small $\left(
\begin{array}{cc}
0 & 1 \\
1 & 0
\end{array}
\right)$}, it is corrected by comparison with the other two qubits in its group of
three.
\end{slide}
\begin{slide}
{\large The 9-qubit code}
{\small
\[
\hspace*{-.6in}\ket{0} \rightarrow \frac{1}{2}
(\ket{000000000}+\ket{000111111} +\ket{111000111} + \ket{111111000})
\]
\[
\hspace*{-.6in}\ket{1} \rightarrow
\frac{1}{2}(\ket{111000000} +\ket{000111000} +\ket{000000111}+\ket{111111111})
\]
}
If you have a phase flip on a single qubit:
{\small $\left(
\begin{array}{cc}
1 & \phantom{-}0 \\
0 & -1
\end{array}
\right)$},
it gives the same result as a phase flip on any of the other qubits
in the same group of three.
The correction works exactly as it does in the three-qubit phase-correcting
code.
\end{slide}
\begin{slide}
Objection: We've shown that our code can correct any one phase flip, or
any one bit-flip. (And in fact, it can correct one phase flip and
a separate bit flip, as these processes are independent.)
But there are an infinite number of kinds of error. How can we correct
those?
\end{slide}
\begin{slide}
Theorem: If you can correct a tensor product of $t$ of
any of the following three types of error
{\small
\[
\sigma_x =
\left(
\begin{array}{cc}
0 & 1 \\
1 & 0
\end{array}
\right), \ \ \
\sigma_y =
\left(
\begin{array}{cc}
0 & {-}i \\
i & \phantom{-}0
\end{array}
\right), \ \ \
\sigma_z =
\left(
\begin{array}{cc}
1 & \phantom{-}0 \\
0 & -1
\end{array}
\right)
\]}
then you can fix any error restricted to $t$ qubits.
Proof Sketch:\newline
The identity matrix and $\sigma_x$, $\sigma_y$ and $\sigma_z$ for a
basis for $2 \times 2$ matrices. One can thus decompose any error
matrix into a sum of these four matrices. If the error only affects
$t$ qubits, it applies the identity matrix to the other qubits, so
the decomposition never has more than $t$ terms in the tensor product
not equal to the identity.
\end{slide}
\begin{slide}
Example in 3-qubit phase code
\begin{eqnarray*}
\ket{0} &\rightarrow & \frac{1}{2}\left( \ket{000} + \ket{011} + \ket{101}
+ \ket{110} \right) \\
\ket{1} &\rightarrow & \frac{1}{2}\left( \ket{100} + \ket{010} + \ket{001}
+ \ket{111} \right)
\end{eqnarray*}
Suppose we apply a general phase error
{\small $
\left(
\begin{array}{cc}
1&\phantom{,}0\\
0& e^{2i\theta}
\end{array}
\right)
$} to qubit 1, say. Can we correct this?
Rewrite error as
{\small $
\left(
\begin{array}{cc}
e^{-i\theta} &\phantom{,}0\\
\phantom{,}0& e^{i\theta}
\end{array}
\right)
$}
We can do this, since global phase changes are immaterial.
\begin{eqnarray*}
\ket{E_0} \rightarrow & & e^{-i \theta}\big(\ket{000} + \ket{011}\big)
+ e^{i \theta}\big(\ket{101} + \ket{110}\big)\\
&=&\cos \theta\big( \ket{000} + \ket{011} + \ket{101} + \ket{110}\big)\\
&& -i \sin \theta \, \big( \ket{000} + \ket{011}\, -\, \ket{101} \,-\, \ket{110}\big)
\end{eqnarray*}
\end{slide}
\begin{slide}
We applied an arbitrary phase error to qubit 1, on an encoded 0.
\begin{eqnarray*}
\ket{E_0} \rightarrow & & e^{-i \theta}\big(\ket{000} + \ket{011}\big)
+ e^{i \theta}\big(\ket{101} + \ket{110}\big)\\
&=&\cos \theta\big( \ket{000} + \ket{011} + \ket{101} + \ket{110}\big)\\
&& -i \sin \theta \big( \ket{000} + \ket{011}\, -\, \ket{101} \,-\,
\ket{110}\big)\\
&=& \cos\theta \ket{E_0} - i \sin\theta \, \sigma_z^{(1)} \ket{E_0}
\end{eqnarray*}
When we measure ``which bit has a phase flip,'' we
get ``bit 1'' with probability $|\sin^2\theta|$.
The state has ``collapsed,'' so our measurement is now correct.
The same thing will happen to any superposition $\alpha \ket{E_0} + \beta
\ket{E_1}$.
\end{slide}
\begin{slide}
We have a 9-qubit code that can correct any error in 1 qubit. How can
we make more general quantum codes?
\end{slide}
\begin{slide}
Better classical codes exist than repetition codes.
The $[7,4,3]$ Hamming code, for example.
The codewords are the binary row space of
\[
\left[
\begin{array}{ccccccc}
1&1&1&0&1&0&0\\
0&1&1&1&0&1&0\\
0&0&1&1&1&0&1\\
1&1&1&1&1&1&1
\end{array}
\right]
\]
This code maps 4 bits to 7 bits. The minimum distance between two codewords
is 3, so it can correct one error.
\end{slide}
\begin{slide}
Generator matrix for Hamming code:
\[
G = \quad \left[
\begin{array}{ccccccc}
1&1&1&0&1&0&0\\
0&1&1&1&0&1&0\\
0&0&1&1&1&0&1\\
1&1&1&1&1&1&1
\end{array}
\right]
\]
To correct errors, we use the parity check matrix $H$. This is
a generator matrix of ${\bf C}^\perp = \{v : v \cdot w = 0
{\mathrm{\ for\ all\ }} w \in {\bf C}\}$.
\[H = \quad \left[
\begin{array}{ccccccc}
1&1&1&0&1&0&0\\
0&1&1&1&0&1&0\\
0&0&1&1&1&0&1
\end{array}
\right]
\]
$H\cdot v = 0$ if $v \in {\bf C}$.
$H\cdot v$ is called the {\em syndrome}. This syndrome gives the location
of the incorrect bits.
\end{slide}
\begin{slide}
{\large Quantum Hamming code}
{\small
\[
\ket{0} \rightarrow \frac{1}{\sqrt{8}} \left(
\begin{array}{cc}
\phantom{+}\ \ket{0000000} & +\ \ket{1110100}\\
+\ \ket{0111010} & +\ \ket{0011101}\\
+\ \ket{1001110} & +\ \ket{0100111}\\
+\ \ket{1010011} & +\ \ket{1101001}
\end{array}
\right) \quad (H)\phantom{+\bar{1}}
\]
\[
\ket{1} \rightarrow \frac{1}{\sqrt{8}} \left(
\begin{array}{cc}
\phantom{+}\ \ket{1100010} & +\ \ket{0110001}\\
+\ \ket{1011000} & +\ \ket{0101100}\\
+\ \ket{0010110} & +\ \ket{0001011}\\
+\ \ket{1000101} & +\ \ket{1111111}
\end{array}
\right) \quad (H +\bar{1})
\]}
The bit flip errors are correctable, since all elements in these
superpositions are in the Hamming code (if you measure the syndrome,
you know which bit to correct).
\end{slide}
\begin{slide}
The phase flip errors are correctable since applying $H$ $=$
{\small
$\left(
\begin{array}{cc}
1 & \phantom{-}1\\
1 & {-}1\\
\end{array}
\right)
$}
to all 7
encoding qubits and to the encoded qubit takes the code to itself.
You can thus correct bit flip errors by correcting phase flips in
the Hadamard dual space.
\end{slide}
\begin{slide}
{\large CSS codes \small (Calderbank \& Shor, Steane)}
Start with two binary codes such that
\[
\{0\} \subseteq {\bf C}_2 \subseteq {\bf C}_1 \subseteq {\bf F}_2^n
\]
(So $\{0\} \subseteq {\bf C}_1^\perp \subseteq {\bf C}_2^\perp \subseteq {\bf F}_2^n$)
The quantum code has basis elements corresponding to
$v \in {\bf C}_1 / {\bf C}_2$.
\[
v \rightarrow \frac{1}{2^{k/2}} \sum_{x \in {\bf C}_2} \ket{v+x}
\]
$k$ = $\dim {\bf C_1} - \dim {\bf C_2}$\\
This will correct $t$ errors, where
\[
2t+1 \leq \min({\mathrm{wt}} {\bf C}_1, {\mathrm{wt}} {\bf C}_2^\perp )
\]
${\bf C}_1$ corrects bit errors\\
${\bf C}_2^\perp$ corrects phase errors
rate: $\frac{\dim {\bf C_1} - \dim {\bf C_2} }{n}$
\end{slide}
\begin{slide}
Suppose we have a CSS code with
\[
\{0\} \subseteq {\bf C}_2 \subseteq {\bf C}_1 \subseteq {\bf F}_2^n.
\]
What happens when we apply $H$ $=$
{\small
$\frac{1}{\sqrt{2}}\left(
\begin{array}{cc}
1&\phantom{-}1\\
1&-1
\end{array}\right)$
}
to each qubit of it?
\end{slide}
\begin{slide}
We start with the encoding of $v \in {\bf C}_1 / {\bf C}_2$:
\[
\ket{E_v} = |{\bf C}_2|^{-1/2}
\sum_{x \in {\bf C}_2} \ket{v + x}.
\]
When we apply $H^{\otimes n}$ to a state $\ket{s}$, we get a $(-1)$ factor
for each qubit where $\ket{1}$ goes to $\ket{1}$. Thus,
\[
H^{\otimes n} \ket{s} = \frac{1}{2^{n/2}} \sum_{t \in {\bf F}_2^n}
(-1)^{s \cdot t} \ket{t}
\]
Applying this to the encoded state $\ket{E_v}$, we get
\[
H^{\otimes n} \ket{E_v} =
\frac{|{\bf C}_2|^{-1/2}}{2^{n/2}} \sum_{t \in {\bf F}_2^n} \sum_{x\in {{\bf C}_2}}
(-1)^{(v+x)\cdot t} \ket{t}
\]
\end{slide}
\begin{slide}
\begin{eqnarray*}
H^{\otimes n} \ket{E_v}
&=&
\frac{|{\bf C}_2|^{-1/2}}{2^{n/2}} \sum_{t \in {\bf F}_2^n} \sum_{x\in {{\bf C}_2}}
(-1)^{(v+x)\cdot t} \ket{t}\\
&=&
\frac{|{\bf C}_2|^{1/2}}{2^{n/2}}
\sum_{t \in {\bf C}_2^\perp}
(-1)^{v\cdot t} \ket{t}\\
&=&
\frac{|{\bf C}_2|^{1/2}}{2^{n/2}}
\sum_{t \in {\bf C}_2^\perp/{\bf C}_1^\perp}
(-1)^{v \cdot t}
\sum_{y\in {{\bf C}_1^\perp}}
\ket{t+y}\\
&=& \frac{1}{2^{k/2}}
\sum_{t \in {\bf C}_2^\perp/{\bf C}_1^\perp}
(-1)^{v \cdot t}
\ket{\hat{E}_t}.
\end{eqnarray*}
where $\ket{\hat{E}_t}$ is $t$ encoded in the dual quantum code,
\[
\{0\} \subseteq {\bf C}_1^\perp \subseteq {\bf C}_2^\perp \subseteq {\bf F}_2^n.
\]
Thus, $H^{\otimes n} \ket{v}$ is the Fourier transform of the
vector~$v$ encoded in the dual quantum code.
\end{slide}
\begin{slide}
Suppose you have a set of errors ${\cal E}_1$, ${\cal E}_2$, $\ldots$,
${\cal E}_k$, and you want the code to correct them exactly. What
properties do your codewords need to have?
Knill-Laflamme criterion.\\
Suppose we have a set of codewords $\ket{w_1}$, $\ket{w_2}$, $\ldots$,
$\ket{w_d}$. Then we need
\[
\bra{w_k}{\cal E}_i^\dag {\cal E}_j \ket{w_l} = \gamma_{i,j} \delta_{k,l}
\]
How does this work?
Recall in the 9-qubit code ${\sigma_z^{(1)}}^\dag \sigma_z^{2} \ket{w_k}=
\ket{w_k}$ for all codewords $\ket{w_k}$, so
a phase error on the first qubit cannot be distinguished from a phase
error on the second. However, this is O.K.; since they both have the
same effect, they can be corrected using same protocol.
This is the worst that can happen on CSS codes or stabilizer codes
(errors are either
orthogonal, or have identical effects).
\end{slide}
\begin{slide}
{\large Quantum Cryptography}
First published in 1982, this was one of the first applications of
quantum weirdness to computer science tasks.
The BB84 (Bennett and Brassard, 1984) protocol is a key distribution
protocol. Two parties, Alice
and Bob, are trying to agree on a key which any eavesdropper (Eve)
will not be able to ascertain by listening to their conversation.
The idea is to use the fact that any attempt to measure a quantum
state must inescapably disturb it. Alice sends Bob photons. Bob
chooses some of these photons at random and checks for disturbance,
while others yield the secret key.
\end{slide}
\begin{slide}
The model we discuss: Alice and Bob have a classical channel which
Eve can eavesdrop, and a quantum channel which Eve can do anything
to (you can't eavesdrop on a quantum channel without disturbing it).
Since Eve can potentially cut the quantum channel, Alice and Bob
don't have any guarantee that they will be able to agree on a key.
The goal of the protocol is to make the chance of Eve knowing a key
that Alice and Bob have agreed on very small.
So with very high probability, Alice and Bob will either agree on a
key that Eve doesn't know, or decide that the quantum channel is too
noisy for secure communication.
\end{slide}
\begin{slide}
A) Alice sends random qubits in one of the four states.
{\small
\[ \ket{0}, \quad \ket{1} ,\quad \frac{1}{\sqrt{2}}(\ket{0}+\ket{1}),
\quad \frac{1}{\sqrt{2}}(\ket{0}-\ket{1})
\]
}
B) Bob measures them randomly in either the $\{\ket{0},\ket{1}\}$ basis
or the $\frac{1}{\sqrt{2}}(\ket{0}\pm\ket{1})$ basis\\
C) Alice and Bob reveal the sending and receiving bases, and obtain a
string of bits that they agree on.
D) Some of these bits are used to test for errors; the rest form the key.
\[
\hspace*{-.3in}
\begin{array}{cccccccccccc}
\qpols& \ppols& \ppols& \hpols& \qpols& \vpols&
\vpols& \ppols& \qpols& \hpols& \hpols& \vpols\\
\times & +& \times & \times & \times & + &
\times & + & \times &+ & + & \times\\
\qpols& \hpols& \ppols& \qpols& \qpols& \vpols&
\qpols& \vpols& \qpols& \hpols& \hpols& \ppols\\
\bullet & & \bullet & & \bullet& \bullet & & & \bullet &\bullet& \bullet& \\
1& & 0 & & 1 & 0 & & & 1 &1& 1 &
\end{array}
\]
\end{slide}
\begin{slide}
Because the density matrices for the two complementary bases are equal, i.e.,
\[
\frac{1}{2} \proj{\vpols} + \frac{1}{2} \proj{\hpols} =
\frac{1}{2} \proj{\ppols} + \frac{1}{2} \proj{\qpols}
\]
Eve cannot measure which basis Alice sent her bits in. If Eve gains
information in about one of the two possible complementary bases, she
disturbs states sent in the other. Thus, if Eve gets any information,
she incurs a probability to perturb the signals, and thus be detected.
But Alice and Bob's channel won't be perfect, so there will be some
disturbance anyway. How can they do quantum cryptography given a noisy
channel?
\end{slide}
\begin{slide}
{\large Quantum Cryptography over Noisy Channels}
Alice and Bob use an error correcting code to fix any errors caused
by noise.
They then apply a hash function to the resulting key to gain privacy.\\
We prove security in the case where they use a {\em linear} hash function.
Alice and Bob take an $n$-bit key $\bf k$, apply a $0$-$1$ $n \times m$
matrix to it, and obtain an $m$-bit key $\bf k'$.
\end{slide}
\begin{slide}
It took till 1996 to obtain a proof of security for quantum cryptography
over noisy channels. We give a much simpler proof (discovered jointly
with John Preskill) by using quantum error correcting codes.
The proof first shows a different key distribution protocol, based on
error correcting codes, is secure, and then shows that the two protocols
are equivalent in terms of what an eavesdropper can learn.
\end{slide}
\begin{slide}
{\large CSS key distribution protocol}
Idea: Alice encodes the key using a CSS code. She sends the CSS code
to Bob, interspersing it with test bits. Bob uses the test bits
to find the error rate, and if the error rate is low enough, he decodes
the key and uses it.
If the error rate is low, the CSS code delivers the encoded state with
high fidelity. Thus, by the no-cloning theorem of quantum information,
the code cannot leak much information, and the key is thus secure.
This code assumes that Bob has quantum memory, as he has to store the
qubits until Alice tells him which are test bits and which are code bits.
So it is currently impractical.
\end{slide}
\begin{slide}
{\large CSS key distribution protocol}
Problem:
We have to make sure that Eve cannot detect which bits are being
used for the code and which bits are being used for the test bits.
(If she could, she could leave the test bits alone, and just measure
the code bits).
Solution:
We use one of a set of shifts of the CSS code. Instead of encoding
\[
v \rightarrow |{\bf C}_2|^{-1/2} \sum_{x \in {\bf C}_2} \ket{v+x}
\]
we pick a random $w \in {\bf F}^n_2/{\bf C}_2^\perp$, $z \in {\bf F}^n_2/{\bf C}_1$ and encode
\[
v \rightarrow |{\bf C}_2|^{-1/2} \sum_{x \in {\bf C}_2} (-1)^{w\cdot x}
\ket{v+x+z}
\]
Adding $z$ gives a random shift of the code, and changing the phase using
$w$ gives a random shift of the code in the Fourier transform space.
\end{slide}
\begin{slide}
Alice sends a random shift of the CSS quantum code
\[
v \rightarrow |{\bf C}_2|^{-1/2} \sum_{x \in {\bf C}_2} (-1)^{w\cdot x}
\ket{v+x+z}
\]
$w \in {\bf F}^n_2/{\bf C}_2^\perp$ and $z \in {\bf F}^n_2/{\bf C}_1$ chosen
at random.
Here Alice has chosen a random $v \in {\bf C}_1 / {\bf C}_2$. The random
choices of Alice have the effect of making the quantum state Alice
perfectly random
(without knowledge of $z$, $w$, which Alice does not reveal until Bob has
received the data). Thus Eve cannot distinguish between the
code bits and the random test bits.
\end{slide}
\begin{slide}
Calculations for previous slide:
The density matrix averaging over all encodings of $v$ is
{\small
\[
\frac{|{\bf C}_1|}{2^{2n}}
\sum_{{w \in {\bf F}^n_2/{\bf C}_2^\perp}\atop
{z \in {\bf F}^n_2/{\bf C}_1}}
\sum_{x_1,x_2 \in {\bf C}_2} (-1)^{w\cdot (x_1+x_2)}
\ket{v+x_1+z} \bra{v+x_2+z} \hspace*{.5in}
\]
\[
\hspace*{-.5in} = \frac{ |{\bf C}_1| } {2^n |{\bf C}_2|}
\sum_{z \in {\bf F}^n_2/{\bf C}_1}
\sum_{x \in {\bf C}_2} \ket{v+x+z}\bra{v+x+z}
\]
}
Since Alice chooses a random $v\in {\bf C}_1 / {\bf C}_2$, this state is
indistinguishable from the maximally random density matrix $2^{-n} I$.
\end{slide}
\begin{slide}
{\large Equivalence to BB84}
Alice never needs to reveal $w$ (the amount the phase encodings are
shifted) because Bob only cares about the bits Alice sends for his key,
and not the phases of these bits; thus, he doesn't need to correct
phase errors.
When averaging over all values of $w$,
for a given key, Eve sees the exact same density matrix for the good
bits of the BB84 key distribution protocol
(those where Alice and Bob use the same basis for sending and receiving),
and the CSS code key distribution protocol. Thus, if one is secure, the
other must also be secure.
\end{slide}
\begin{slide}
{\large Details of Equivalence}
CSS codes are composed of two linear codes, one to correct the bit values,
and the other to correct the phases. BB84 has a linear code to
correct errors, and a linear hash function used for privacy amplification.
The bit correcting code of CSS is exactly the error correcting code for BB84.
The phase correcting code of CSS corresponds to the linear hash function
for BB84 (The code consists of everything mapped to 0 by the hash function).
For further details, one needs to write down the equations.
\end{slide}
\begin{slide}
{\large Equivalence to BB84}
Alice sends a random shift of the quantum code
\[
v \rightarrow |{\bf C}_2|^{-1/2} \sum_{x \in {\bf C}_2} (-1)^{w\cdot x}
\ket{v+x+z}
\]
Alice never needs to reveal $w$; since Bob wants to get the bits Alice
sends and doesn't care about the phases, he doesn't need to correct
the phase errors. Thus, the state Bob receives, for a given key $v$ and
a given shift $z$, is the average over $w$ of
the quantum states encoded above, or the density matrix
{\small
\[ \hspace*{-.15in}
2^{-n}\sum_{w \in {\bf F}_2^n/{\bf C}_2^\perp}
\left( \sum_{x_1 \in {\bf C}_2} (-1)^{w\cdot x_1}
\ket{v+x_1+z}\right)
\left( \sum_{x_2 \in {\bf C}_2} (-1)^{w\cdot x_2}
\bra{v+x_2+z}\right)
\]
}
\end{slide}
\begin{slide}
Bob receives
{\small
\[
2^{-n}
\sum_{w \in {\bf F}_2^n/{\bf C}_2^\perp}
\sum_{x_1,x_2 \in {\bf C}_2} (-1)^{w\cdot (x_1+x_2)}
\ket{v+x_1+z} \bra{v+x_2+z}
\]
\[
\hspace*{.4in}= \frac{1}{|{\bf C}_2|}
\sum_{x \in {\bf C}_2} \ket{v+x+z}\bra{v+x+z}
\]
}
This average destroys all the phase information, and thus is the same
as the average over $x \in {\bf C}_2$ of $\ket{v+x+z}$. Now, we see the
equivalence to BB84. The code ${\bf C}_1$ is the error correcting code
used in BB84 to fix hash errors. The code ${\bf C}_2$ corresponds to
the linear hash function in BB84,
as adding any vector in ${\bf C}_2$ gives the
same key, and is thus equivalent to multiplying by a generator matrix for
${\bf C}_2^\perp$.
\end{slide}
\begin{slide}
Eve sees the same density matrix arising from the good bits of BB84
(those where Alice and Bob use the same basis for sending and receiving)
and the CSS key distribution protocol. Thus, if one is secure, the other
is as well.
\end{slide}
% \begin{slide}
% {\large Density Matrices II}
%
% Suppose you have a joint quantum system on ${\mathbb{C}}^a \otimes {\mathbb{C}}^b$
% in the state $\rho_{AB}$.
% If you can only do experiments on the first part of the system, it is
% effectively in the state
% \[
% \rho_A = \mathrm{Tr}_B \ \rho_{AB}
% \]
%
% If you have a joint system in the state
% \[
% \rho_{AB} = \left(
% \begin{array}{ccc}
% B_{11}& B_{12}& B_{13}\\
% B_{21}& B_{22}& B_{23}\\
% B_{31}& B_{32}& B_{33}
% \end{array}
% \right)
% \]
%
% Then
% \[
% \mathrm{Tr}_A \ \rho_{AB} =
% B_{11} + B_{22} + B_{33}
% \]
% and
% \[
% \mathrm{Tr}_B \ \rho_{AB} = \left(
% \begin{array}{ccc}
% \mathrm{ Tr} \,B_{11}& \mathrm{ Tr} \,B_{12}& \mathrm{ Tr} \,B_{13}\\
% \mathrm{ Tr} \,B_{21}& \mathrm{ Tr} \,B_{22}& \mathrm{ Tr} \,B_{23}\\
% \mathrm{ Tr} \,B_{31}& \mathrm{ Tr} \,B_{32}& \mathrm{ Tr} \,B_{33}
% \end{array}
% \right)
% \]
%
% \end{slide}
%
% \begin{slide}
% {\large Von Neumann Measurements}
%
% Suppose you have a quantum state space ${\mathbb{C}}^n$. A von
% Neumann measurement corresponds to a complete
% set of orthogonal subspaces $S_1$, $S_2$, $\ldots$ $S_k$. (Complete
% means the $S_i$ span ${\mathbb{C}}^n$.)
%
% Let $\Pi_{S_i}$ be the projection onto the $i$'th subspace $S_i$.
%
% The corresponding von Neumann measurement operating on the
% density matrix $\rho \in {\mathbb{C}}^n \times
% {\mathbb{C}}^n$ takes $\rho$ to $\Pi_{S_i} \, \rho\, \Pi_{S_i}$ with probability
% $\mathrm{Tr} (\, {\Pi_{S_i}}\, \rho)$.
%
% The simplest situation is if each of the $S_i$ is one-dimensional, and
% then $S_i = v_i v_i^\dag$, where the $v_i$ form a basis of ${\mathbb{C}}^n$.
% \end{slide}
%
% \begin{slide}
% Entropy of a quantum state
%
% Classical Case\\
% Given $n$ photons, each in state $\vpols$ or $\hpols$, with probability
% $\frac{1}{2}$. Any two of these states are completely distinguishable.
% The entropy is $n$ bits.
%
% Quantum Case\\
% Given $n$ photons, each in state $\vpols$ or $\ppols$, with probability
% $\frac{1}{2}$. If the angle between the polarizations is small,
% any two of these states are barely distinguishable.
% Intuitively, the entropy should be much less than $n$ bits.
%
% \end{slide}
%
\end{document}